⬆️ Update JVM dependencies in backend and common

Update several JVM dependencies across backend and common:

- passay 1.6.6 -> 2.0.0 (package reorg, ctor-based rules)
- siphash 2.0.0 -> 3.0.0 (SipHasher* renamed to SipHash*)
- lettuce-core, guava, sqlite-jdbc, jsoup, lz4-java, markdown-clj,
  awssdk s3/sts, selmer, jackson-core/databind, shadow-cljs

Adapt passay validation to the new API (moved packages, constructor
configuration) and siphash to the renamed classes. Add tests for
password validation and UUID advisory-lock hashing.

AI-assisted-by: deepseek-v4-flash

backend/deps.edn

@@ -17,7 +17,7 @@
 
   io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"}
 
-  io.lettuce/lettuce-core {:mvn/version "7.6.0.RELEASE"}
+  io.lettuce/lettuce-core {:mvn/version "7.7.0.RELEASE"}
   ;; Minimal dependencies required by lettuce, we need to include them
   ;; explicitly because clojure dependency management does not support
   ;; yet the BOM format.
@@ -25,7 +25,7 @@
   io.micrometer/micrometer-observation {:mvn/version "1.14.2"}
 
   java-http-clj/java-http-clj {:mvn/version "0.4.3"}
-  com.google.guava/guava {:mvn/version "33.6.0-jre"}
+  com.google.guava/guava {:mvn/version "33.7.1-jre"}
 
   funcool/yetti
   {:git/tag "v11.10"
@@ -40,32 +40,32 @@
   nrepl/nrepl {:mvn/version "1.7.0"}
 
   org.postgresql/postgresql {:mvn/version "42.7.13"}
-  org.xerial/sqlite-jdbc {:mvn/version "3.53.2.1"}
+  org.xerial/sqlite-jdbc {:mvn/version "3.53.4.0"}
 
   com.zaxxer/HikariCP {:mvn/version "7.1.0"}
 
-  io.whitfin/siphash {:mvn/version "2.0.0"}
+  io.whitfin/siphash {:mvn/version "3.0.0"}
 
   buddy/buddy-hashers {:mvn/version "2.0.167"}
   buddy/buddy-sign {:mvn/version "3.6.1-359"}
-  org.passay/passay {:mvn/version "1.6.6"}
+  org.passay/passay {:mvn/version "2.0.0"}
 
   com.github.ben-manes.caffeine/caffeine {:mvn/version "3.2.4"}
 
-  org.jsoup/jsoup {:mvn/version "1.23.1"}
+  org.jsoup/jsoup {:mvn/version "1.23.2"}
 
   at.yawk.lz4/lz4-java
-  {:mvn/version "1.11.1"}
+  {:mvn/version "1.11.2"}
 
   org.clojars.pntblnk/clj-ldap {:mvn/version "0.0.17"}
 
   dawran6/emoji {:mvn/version "0.2.0"}
-  markdown-clj/markdown-clj {:mvn/version "1.12.8"}
+  markdown-clj/markdown-clj {:mvn/version "1.12.9"}
 
   ;; Pretty Print specs
   pretty-spec/pretty-spec {:mvn/version "0.1.4"}
-  software.amazon.awssdk/s3 {:mvn/version "2.50.1"}
+  software.amazon.awssdk/s3 {:mvn/version "2.54.5"}
-  software.amazon.awssdk/sts {:mvn/version "2.50.1"}}
+  software.amazon.awssdk/sts {:mvn/version "2.54.5"}}
 
  :paths ["src" "resources" "target/classes"]
  :aliases

backend/src/app/auth/passwords.clj

@@ -9,7 +9,9 @@
   (:require
    [app.common.exceptions :as ex])
   (:import
-   [org.passay CharacterCharacteristicsRule CharacterRule EnglishCharacterData PasswordData]))
+   [org.passay PasswordData]
+   [org.passay.data EnglishCharacterData]
+   [org.passay.rule CharacterCharacteristicsRule CharacterRule]))
 
 (defonce ^:private passay-code->translation-key
   {"INSUFFICIENT_LOWERCASE"   "errors.weak-password.insufficient-lowercase"
@@ -18,12 +20,13 @@
    "INSUFFICIENT_SPECIAL"     "errors.weak-password.insufficient-special"})
 
 (defonce ^:private character-characteristics-rule
-  (doto (CharacterCharacteristicsRule.)
+  (CharacterCharacteristicsRule.
-    (.setRules [(CharacterRule. EnglishCharacterData/LowerCase 1)
+   4
+   (into-array org.passay.rule.CharacterRule
+               [(CharacterRule. EnglishCharacterData/LowerCase 1)
                 (CharacterRule. EnglishCharacterData/UpperCase 1)
                 (CharacterRule. EnglishCharacterData/Digit 1)
-                (CharacterRule. EnglishCharacterData/Special 1)])
+                (CharacterRule. EnglishCharacterData/Special 1)])))
-    (.setNumberOfCharacteristics 4)))
 
 (defn validate-password
   "Validates password strength.

backend/src/app/db.clj

@@ -31,8 +31,8 @@
    com.zaxxer.hikari.HikariDataSource
    com.zaxxer.hikari.HikariPoolMXBean
    com.zaxxer.hikari.metrics.prometheus.PrometheusMetricsTrackerFactory
-   io.whitfin.siphash.SipHasher
+   io.whitfin.siphash.SipHash
-   io.whitfin.siphash.SipHasherContainer
+   io.whitfin.siphash.SipHashContext
    java.io.InputStream
    java.io.OutputStream
    java.sql.Connection
@@ -701,12 +701,12 @@
 ;; --- Locks
 
 (def ^:private siphash-state
-  (SipHasher/container
+  (SipHash/context
-   (uuid/get-bytes uuid/zero)))
+    (uuid/get-bytes uuid/zero)))
 
 (defn uuid->hash-code
   [o]
-  (.hash ^SipHasherContainer siphash-state
+  (.hash ^SipHashContext siphash-state
          ^bytes (uuid/get-bytes o)))
 
 (defn- xact-check-param

backend/test/backend_tests/db_test.clj

@@ -6,6 +6,7 @@
 
 (ns backend-tests.db-test
   (:require
+   [app.common.uuid :as uuid]
    [app.db :as db]
    [backend-tests.helpers :as th]
    [clojure.test :as t])
@@ -41,3 +42,13 @@
 
     (t/testing "maximum pool size is reasonable"
       (t/is (pos? (:maximum-pool-size stats))))))
+
+(t/deftest uuid->hash-code-is-deterministic
+  (t/is (= (db/uuid->hash-code uuid/zero)
+           (db/uuid->hash-code uuid/zero))))
+
+(t/deftest uuid->hash-code-returns-long
+  (t/is (instance? Long (db/uuid->hash-code uuid/zero))))
+
+(t/deftest uuid->hash-code-stable-for-zero-uuid
+  (t/is (= 3659997967308761462 (db/uuid->hash-code uuid/zero))))

backend/test/backend_tests/passwords_test.clj

@@ -0,0 +1,51 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC Sucursal en España SL
+
+(ns backend-tests.passwords-test
+  (:require
+   [app.auth.passwords :as passwords]
+   [backend-tests.helpers :as th]
+   [clojure.test :as t]))
+
+(defn- run-validation
+  [password]
+  (try
+    (passwords/validate-password password)
+    nil
+    (catch Throwable e
+      e)))
+
+(t/deftest validate-password-accepts-strong-password
+  (t/is (nil? (run-validation "Str0ng!Pass"))))
+
+(t/deftest validate-password-rejects-too-short-password
+  (let [error (run-validation "Ab1!x")]
+    (t/is (th/ex-of-code? error :weak-password))
+    (t/is (= ["errors.weak-password.too-short"] (:details (ex-data error))))))
+
+(t/deftest validate-password-rejects-missing-lowercase
+  (let [error (run-validation "ABCDEFG1!")]
+    (t/is (th/ex-of-code? error :weak-password))
+    (t/is (= ["errors.weak-password.insufficient-lowercase"]
+             (:details (ex-data error))))))
+
+(t/deftest validate-password-rejects-missing-uppercase
+  (let [error (run-validation "abcdefg1!")]
+    (t/is (th/ex-of-code? error :weak-password))
+    (t/is (= ["errors.weak-password.insufficient-uppercase"]
+             (:details (ex-data error))))))
+
+(t/deftest validate-password-rejects-missing-digit
+  (let [error (run-validation "Abcdefgh!")]
+    (t/is (th/ex-of-code? error :weak-password))
+    (t/is (= ["errors.weak-password.insufficient-digits"]
+             (:details (ex-data error))))))
+
+(t/deftest validate-password-rejects-missing-special
+  (let [error (run-validation "Abcdefgh1")]
+    (t/is (th/ex-of-code? error :weak-password))
+    (t/is (= ["errors.weak-password.insufficient-special"]
+             (:details (ex-data error))))))

common/deps.edn

@@ -17,14 +17,14 @@
   org.slf4j/slf4j-api {:mvn/version "2.0.18"}
   pl.tkowalcz.tjahzi/log4j2-appender {:mvn/version "0.9.43"}
 
-  selmer/selmer {:mvn/version "1.13.4"}
+  selmer/selmer {:mvn/version "1.13.5"}
   criterium/criterium {:mvn/version "0.4.6"}
 
   metosin/jsonista {:mvn/version "1.0.0"
                     :exclusions [com.fasterxml.jackson.core/jackson-core
                                  com.fasterxml.jackson.core/jackson-databind]}
-  com.fasterxml.jackson.core/jackson-core {:mvn/version "2.22.1"}
+  com.fasterxml.jackson.core/jackson-core {:mvn/version "2.22.2"}
-  com.fasterxml.jackson.core/jackson-databind {:mvn/version "2.22.1"}
+  com.fasterxml.jackson.core/jackson-databind {:mvn/version "2.22.2"}
 
 
   metosin/malli {:mvn/version "0.20.1"}
@@ -60,7 +60,7 @@
  {:dev
   {:extra-deps
    {org.clojure/tools.namespace {:mvn/version "1.5.1"}
-    thheller/shadow-cljs {:mvn/version "3.4.11"}
+    thheller/shadow-cljs {:mvn/version "3.5.0"}
     com.clojure-goes-fast/clj-async-profiler {:mvn/version "2.0.0-beta1"}
     com.bhauman/rebel-readline {:mvn/version "0.1.11"}
     criterium/criterium {:mvn/version "0.4.6"}

exporter/deps.edn

@@ -14,7 +14,7 @@
 
   :dev
   {:extra-deps
-   {thheller/shadow-cljs {:mvn/version "3.4.11"}}}
+   {thheller/shadow-cljs {:mvn/version "3.5.0"}}}
 
   :shadow-cljs
   {:main-opts ["-m" "shadow.cljs.devtools.cli"]

frontend/deps.edn

@@ -3,7 +3,7 @@
  {penpot/common
   {:local/root "../common"}
 
-  org.clojure/clojure {:mvn/version "1.12.2"}
+  org.clojure/clojure {:mvn/version "1.12.5"}
   binaryage/devtools {:mvn/version "RELEASE"}
   metosin/reitit-core {:mvn/version "0.10.1"}
   funcool/okulary {:mvn/version "2022.04.11-16"}
@@ -50,7 +50,7 @@
               "--enable-native-access=ALL-UNNAMED"]
 
    :extra-deps
-   {thheller/shadow-cljs {:mvn/version "3.4.11"}
+   {thheller/shadow-cljs {:mvn/version "3.5.0"}
     com.bhauman/rebel-readline {:mvn/version "RELEASE"}
     org.clojure/tools.namespace {:mvn/version "RELEASE"}
     criterium/criterium {:mvn/version "0.4.6"}}}